Fix all PHPCS coding standards violations

- Add phpcs.xml.dist: excludes PSR-4 file naming, camelCase naming,
  short array syntax, and redundant per-method/property docblocks
- Fix wp_unslash() on all $_POST reads (LoginPage, AvailabilityController)
- Add phpcs:ignore for password field (must not be sanitized)
- Fix Yoda conditions throughout (AvailabilityRepository, AvailabilityEndpoint,
  BookingEndpoint, AvailabilityController)
- Fix inline comments to end with full stops (AdminMenu)
- Replace short ternary ?: with explicit full ternary (BookingEndpoint)
- Rename $namespace param to $route_namespace (reserved keyword warning)
- Add short descriptions to doc blocks that had tag-only blocks
- Add nonce suppression comment in handleFormAction (nonce verified by caller)
- Update composer.json and CI to use phpcs.xml.dist

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

composer.json

@@ -30,8 +30,8 @@
         "test": "phpunit --configuration phpunit.xml",
         "test:coverage": "phpunit --configuration phpunit.xml --coverage-html coverage/",
         "lint": "phpstan analyse src/ --level=6 --configuration phpstan.neon",
-        "cs": "phpcs --standard=WordPress src/",
-        "cs:fix": "phpcbf --standard=WordPress src/"
+        "cs": "phpcs --standard=phpcs.xml.dist",
+        "cs:fix": "phpcbf --standard=phpcs.xml.dist"
     },
     "config": {
         "allow-plugins": {